Download this file
| 1 | //go:build linux |
| 2 | |
| 3 | package cgroup |
| 4 | |
| 5 | import ( |
| 6 | "errors" |
| 7 | "os/exec" |
| 8 | "syscall" |
| 9 | ) |
| 10 | |
| 11 | // setInto arms cmd for clone3-into-cgroup without clobbering any |
| 12 | // SysProcAttr build() already configured (Setpgid, Pdeathsig, ...) — build() |
| 13 | // owns all Cmd configuration; Start only adds to it, never replaces it. |
| 14 | // Only the strict claims path ((*Prepared).Start) places with clone3 now; |
| 15 | // the Manager's starts place through the shim and never set these fields. |
| 16 | func setInto(cmd *exec.Cmd, fd int) { |
| 17 | if cmd.SysProcAttr == nil { |
| 18 | cmd.SysProcAttr = &syscall.SysProcAttr{} |
| 19 | } |
| 20 | cmd.SysProcAttr.UseCgroupFD = true |
| 21 | cmd.SysProcAttr.CgroupFD = fd |
| 22 | } |
| 23 | |
| 24 | // shouldLatch reports whether err proves clone3-into-cgroup is unavailable |
| 25 | // for the life of this process — EPERM (a seccomp filter predating clone3, |
| 26 | // or one that forbids it outright) and ENOSYS (a kernel predating clone3, |
| 27 | // or RestrictNamespaces=yes's filter) mean the mechanism itself is gone; |
| 28 | // EINVAL means the kernel understood clone3 but rejected CLONE_INTO_CGROUP. |
| 29 | // The strict claims path answers ErrStrictUnsupported for these. Anything |
| 30 | // else (e.g. ENOENT or ENODEV from the cgroup dir disappearing) is |
| 31 | // spawn-specific and says nothing about the mechanism. |
| 32 | func shouldLatch(err error) bool { |
| 33 | return errors.Is(err, syscall.EPERM) || errors.Is(err, syscall.ENOSYS) || errors.Is(err, syscall.EINVAL) |
| 34 | } |
| 35 | |
amadan